Charles Pratt & Co. LLC

Charles Pratt & Company, LLC notified the NH AG of a phishing incident where an employee clicked a malicious link, compromising their email. The attacker used the account to execute a Business Email Compromise (BEC) fraud on June 26, 2025. Forensic review later revealed the attacker accessed a file containing client PII (SSNs, DOBs, bank accounts) around June 23, 2025. One NH resident was notified.

Charles Pratt & Co. LLC reported a data breach to the Maine Attorney General, stating that an external system breach (hacking) occurred on June 23, 2025. The breach was discovered on November 19, 2025. The incident affected 4 Maine residents. The company provided written notification to the affected individuals on December 9, 2025, and offered two years of credit monitoring and identity theft recovery services through Aura.

Charles Pratt & Company, LLC notified Vermont AG of a phishing incident where an employee clicked a malicious link, allowing an intruder access to email and a file containing client PII (SSNs, DOBs, addresses, bank account numbers). The intruder also initiated a fraudulent wire transfer which was reversed. The company engaged forensic firm Cypfer, implemented security enhancements, and offered 2 years of identity protection.